search

phillord / mathjax-latex

Wordpress Plugin for MathJax mathematics renderer
GNU General Public License v2.0
57 stars 12 forks source link

MathJax-LaTeX should use safe-mode by default #2

Open pweaver opened 11 years ago

pweaver commented 11 years ago

Wordpress allows comments by default. Safe mode should be enabled by default on a Wordpress MathJax Plugin to prevent XSS attacks.

See http://docs.mathjax.org/en/latest/safe-mode.html

grettke commented 2 years ago

@pweaver Is this ticket resolved?

paulschreiber commented 2 years ago

@grettke Safe mode is no longer part of the MathJax documentation

pweaver commented 2 years ago

I haven't used this in years. WordPress still allows comments on most pages and as far as I can tell this extension still basically allows security issues which can lead to XSS or DOS attacks if MathML is used in the comments. See https://docs.mathjax.org/en/latest/options/safe.html